CVE-2026-40873
HighSummary
mailcow: dockerized before version 2026-03b has an XSS vulnerability in the Quarantine details modal, where attachment filenames are inserted into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account.
Risk Assessment
The risk includes admin account takeover, which could lead to full compromise of the mail system and access to all data.
Recommendation
Upgrade mailcow to version 2026-03b, which contains the fix. Also educate administrators about the risks of opening suspicious quarantine items.
Other vulnerabilities in mailcow: dockerized
See all- CVE-2026-40875High
mailcow: dockerized before version 2026-03b has an XSS vulnerability in the "Seen successful connections" (login history) view, where the client IP is rendered without HTML escaping. Because the server trusts the X-Real-IP header as the source IP, an attacker can inject HTML/JS. This Self-XSS can be exploited by Login CSRF to force the victim into the attacker's account.
- CVE-2026-40872Critical
In mailcow: dockerized before 2026-03b, Autodiscover logs in the admin dashboard render the EMailAddress value without HTML escaping. An unauthenticated attacker can submit a crafted Autodiscover request with HTML/JS, which executes when an admin views the logs.
- CVE-2026-7460High
A stored cross-site scripting vulnerability was discovered in the administrator Queue Manager of mailcow-dockerized. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.
Original NVD description (English source)
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.